Last updated: 2026-11-06
The BAIT (Circular 10/2017 (BA), BaFin’s supervisory requirements for IT in banks) are BaFin’s IT circular for credit institutions and financial services institutions. They will be repealed in full at the end of 31 December 2026. DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 and replaces them in two steps. This page shows which step applies to your institution and gives an overview of all BAIT chapters, the complete mapping as an Excel file and a conversion list for your existing documents.
Which group are you in?
What decides the route is whether your institution is already covered by Article 2 DORA or only through the KWG.
| Group | Who belongs to it | Until 31 Dec 2026 | From 1 Jan 2027 |
|---|---|---|---|
| (a) Under DORA since 2025 | CRR credit institutions (deposit-taking and lending business) and other institutions that apply DORA directly under Article 2 | Full DORA framework (Articles 5 to 15) since 17 January 2025. The BAIT have not applied to them since that day. | full framework, unchanged |
| (b) KWG group under Section 1a(2a) KWG | Institutions not already covered by Article 2 DORA, according to BaFin in particular guarantee banks, financial services institutions such as factoring and finance leasing firms and crypto securities registrars, housing companies with savings schemes and third-country branches | BAIT until the end of 31 December 2026. Of DORA, only incident reporting (Chapter III) applies, but it has applied since 17 January 2025. | simplified framework under Article 16 instead of Articles 5 to 15, third-party risk under Articles 28 to 30 (not for microenterprises), no TLPT |
On this website we call group (b) the KWG group for short. Its legal basis is Section 1a(2a) in conjunction with Section 65a(3) KWG. Whether your institution belongs to it and whether it counts as a microenterprise is clarified by the applicability check. The BAIT also apply to financial holding companies until 31 December 2026. What applies afterwards is open, because they are not listed in Section 1a(2a) KWG.
Status of the BAIT: what still applies, and to whom?
The applicable version is Circular 10/2017 (BA) as amended on 16 December 2024, effective from 17 January 2025. Its scope follows AT 2.1 of the MaRisk (Minimum Requirements for Risk Management). Since 17 January 2025, all institutions that must operate ICT risk management under Articles 5 to 15 or Article 16 DORA are excluded, and Chapter 11 has been repealed. In its news of 9 January 2025, BaFin announces: “The BAIT will therefore be repealed in full at the end of 31 December 2026.” (our translation)
In this version the BAIT have eleven chapters in force, listed individually in the table below. BaFin repealed the sister circulars KAIT, VAIT and ZAIT (for fund management companies, insurers and payment institutions) at the end of 16 January 2025. For insurers, the page VAIT and DORA shows the conversion. We cover fund management companies and payment institutions separately.
BAIT → DORA chapter by chapter
BaFin has compared the BAIT with the DORA requirements twice: in June 2024 for the full framework (supervisory notice published on 8 July 2024) and on 21 August 2025 for the simplified framework under Article 16. Its overall verdict for Article 16: the requirements are lower than those of the BAIT, while the differences in third-party risk are smaller. By their own account, neither notice is a binding interpretation.
Our mapping assigns each of the 79 numbered paragraphs (Tz.) in force individually. Under the full framework, 36 are stricter, 28 unchanged in substance, for 13 the explicit requirement falls away, and 2 face a new DORA requirement without an equivalent BAIT precedent (digital operational resilience strategy, ICT risk control function). Under the Article 16 framework, 37 stay the same, 13 are stricter, and for 29 there is no explicit requirement any more. 53 assignments follow a BaFin comparison, 18 we derived from the legal text, 8 are marked “check”.
In this table, “falls away” always means: no explicit requirement any more. The task behind it almost always remains, through another article, through the MaRisk or through the requirement for proper business organisation. No row is a recommendation to abolish a role, a document or a safeguard.
| BAIT chapter (Tz.) | Status full framework / Article 16 | No explicit requirement any more (Article 16) | Task that remains |
|---|---|---|---|
| 1 IT strategy (2) | 1 new, 1 same / 2 fall away | IT strategy | CRR credit institutions: ICT strategy under MaRisk AT 4.2. BaFin considers an IT strategy advisable in the Article 16 case as well. |
| 2 IT governance (5) | 3 same, 2 stricter / 2 same, 2 stricter, 1 falls away | key figures for steering IT operations | overall responsibility of the management body, budget reviewed at least annually, segregation and independence of control and internal audit |
| 3 Information risk management (11) | 5 same, 3 stricter, 3 fall away / 7 same, 1 stricter, 3 fall away | information network (Informationsverbund) and protection needs assessment in BAIT form, fixed reporting cycle | classification of functions and assets, regular documented risk assessment with tolerance thresholds |
| 4 Information security management (10) | 3 same, 4 stricter, 1 new, 2 fall away / 2 same, 2 stricter, 6 fall away | information security officer as a role, information security guidelines, approval of the policy by the management body | information security policy, clear responsibility for the security officer’s tasks, security objectives of the management body, training of staff and management, testing plan under RTS Article 36 and testing programme under Articles 24 and 25 (our reading, see below) |
| 5 Operational information security (6) | 1 same, 5 stricter / 5 same, 1 stricter | - | automated vulnerability scanning and patches, logging, plan for security tests |
| 6 Identity and access management (8) | 4 same, 4 stricter / 5 same, 1 stricter, 2 fall away | authorisation concepts and their review | need-to-know, need-to-use, least privilege, recertification, logging of privileged access, strong authentication |
| 7 IT projects and application development (14) | 7 same, 4 stricter, 3 fall away / 8 same, 1 stricter, 5 fall away | project documentation and lessons learned, rules for end-user computing (IDV) | project management procedure, controlled changes (now all changes, not only material ones), testing and approval before use |
| 8 IT operations (8) | 2 same, 6 stricter / 5 same, 1 stricter, 2 fall away | backup concept as a document, disruption management in BAIT form | backup with annually tested restoration, incident handling and reporting under Articles 17 to 19 |
| 9 Outsourcing and other external procurement (5) | 1 same, 4 stricter / 1 same, 4 stricter | - | Articles 28 to 30 (except the third-party risk strategy under Article 28(2), not at all for KWG microenterprises): risk assessment before entering into a contract, mandatory contract content, register of information. Sector outsourcing rules apply in parallel. |
| 10 IT contingency management (5) | 1 same, 4 stricter / 2 same, 3 fall away | IT emergency concept with emergency plans, objectives of IT contingency management, test concept | business continuity plan with cyber-attack scenario, BIA, recovery levels and timeframes, annual tests. Emergency concept under MaRisk AT 7.3. |
| 11 [repealed] | - | - | - |
| 12 Critical infrastructures (5) | 5 fall away / 5 fall away | critical infrastructure (KRITIS) protection objective as a separate chapter | Protective measures support the critical or important functions. Section 28(6) of the German BSI Act (BSIG) exempts DORA entities from several BSIG obligations, including Sections 30 and 32. For the KWG group this follows from the wording from 1 January 2027. For the period before that, it is not established. |
The number in brackets is the number of numbered paragraphs. The references in DORA and the RTS per paragraph and framework are in the Excel file. On the tests in chapters 4 and 5: that the testing programme under Articles 24 and 25 DORA also applies under the Article 16 framework is our reading, and we recommend planning for it as a precaution. The reasoning, and everything the Article 16 framework requires overall, built up from DORA and with evidence per article, is on the page on the simplified framework under Article 16.
BAIT-DORA mapping as Excel
The mapping sets out the table above for every numbered paragraph: a summary of the BAIT requirement in our own words, references under the full framework (DORA, RTS (EU) 2024/1774 Title II) and under the Article 16 framework (Article 16 DORA, RTS Title III), status per framework, continuing sector obligation, suitable evidence, implementation note, source and type of assignment.
Version 2.1 of 6 November 2026, legal status BAIT Circular 10/2017 (BA) as amended on 16 December 2024, MaRisk Circular 06/2026 (BA). Download the mapping: Excel (xlsx, in German)
You may use and edit the mapping within your organisation. Publication or resale is not permitted. If you pass the file on, for example to auditors or service providers, please cite this page as the source.
The file has four sheets: Mapping BAIT-DORA (80 rows, chapter 11 marked as repealed, with filter), Neu in DORA (new in DORA: 27 requirements without a BAIT precedent), Lesehinweise (reading notes: status, framework, MaRisk, microenterprises, logging, open questions, use, sources) and Versionen (versions).
Preview (three rows, texts shortened and translated):
| Tz. | BAIT summary | Article 16 framework | Status full framework | Status Article 16 |
|---|---|---|---|---|
| 1.1 | The management board sets a sustainable IT strategy under MaRisk AT 4.2 with objectives and measures. | no strategy required, RTS Article 28(2)(a) | new | explicit requirement falls away |
| 4.4 | The management board establishes the function of the information security officer with defined tasks. | no counterpart, RTS Article 28(2)(b) (clear tasks for all ICT-related functions) | new | explicit requirement falls away |
| 8.7 | Backup concept with requirements for availability, readability and currency, restoration tested at least annually. | RTS Article 39(2)(g) (backup: scope, minimum frequency) and point (f) (recovery and restoration), RTS Article 40(1) (tests at least annually) | stricter | explicit requirement falls away |
How to use the mapping: Filter by your framework and start with the rows marked “stricter” (in the file: “verschärft”), where something is most likely missing. For “explicit requirement falls away” (“ausdrückliche Vorgabe entfällt”), read the implementation note and the sector obligation before you change a document. Rows marked “check” (“prüfen”) need to be clarified in the individual case. Then record your existing document for each row, for example in a conversion list like the one below.
The mapping is a working aid and not legal advice. It does not replace reading the legal texts, and a fully assigned list does not by itself show that your measures are appropriate and effective.
What DORA adds
Four requirements were unknown to the BAIT or only touched on, and they affect every former BAIT institution, whichever framework applies:
- Reporting of ICT-related incidents (Chapter III): classify incidents and report major ICT-related incidents to BaFin, for the KWG group since 17 January 2025 and without planning on weekend relief. Details are on the page on deadlines and process of the DORA reporting obligation.
- Register of information (Article 28(3)): a register of all contractual arrangements for ICT services, under the Article 16 framework as well, only not for microenterprises of the KWG group. No source we have read states when the KWG group first submits it.
- Need-to-use: access rights only on a need-to-use basis, privileged access only when required and logged (RTS Article 33).
- Classification with BIA: identify critical or important functions, assets and dependencies, with the business impact analysis approved by the management body, under the Article 16 framework as well (RTS Article 30, Article 28(2)(d)). More on this: classifying critical or important functions.
Under the Article 16 framework, this includes among other things the protection of data in use, automated vulnerability scanning and, on our reading, the testing programme under Articles 24 and 25 (see above). Under the full framework, the digital operational resilience strategy, the ICT risk control function, the crisis management function and cryptographic key management under RTS Article 7 are added as well. The “Neu in DORA” sheet of the Excel file lists all 27 points with references.
What the MaRisk still requires
The MaRisk do not disappear with the BAIT: in the version of Circular 06/2026 (BA) they continue to apply alongside DORA, in full for credit institutions (except those directly supervised by the ECB) and for financial services institutions only to the extent required by their size and business, in particular AT 3, 5, 7 and 9. For factoring and leasing firms, emergency management under AT 7.3 is therefore among the modules expressly named, while the ICT strategy under AT 4.2 is not a certain obligation for them. ICT services subject to Articles 28 to 30 DORA no longer fall under AT 9, so for microenterprises of the KWG group, procurement of ICT services remains in AT 9. BaFin recommends that you check whether the DORA implementation is a material change under AT 8.2. The interfaces between MaRisk and DORA are shown on the page MaRisk and DORA.
Conversion list: which BAIT documents to keep, slim down or replace?
Most content stays and moves into a different structure. Fictitious example, not a client: an institution of the KWG group with 45 employees (so not a microenterprise) uses the mapping in autumn 2026 to decide what happens to each BAIT document. The aim is to maintain nothing twice and to lose no safeguard.
Conversion list (template to fill in, completed with fictitious data, as of 6 November 2026):
| BAIT document | BAIT | Recommendation | What happens to it | Basis from 1 Jan 2027 | Status |
|---|---|---|---|---|---|
| IT strategy | Tz. 1.1, 1.2 | keep, slim down | stays as the link to the business strategy, applicability of AT 4.2 MaRisk clarified with compliance | RTS Article 28(2)(a), BaFin recommendation (supervisory notice of 21 August 2025, section 2.1) | converted |
| Key figures on IT operations | Tz. 2.5 | slim down | only what the management board needs for steering | RTS Article 28(2)(i) | converted |
| Appointment of the information security officer | Tz. 4.4 to 4.6 | keep, redefine tasks | role stays, tasks rewritten against the RTS articles, deputy arranged | RTS Article 28(2)(b), (4) | converted |
| Information security policy | Tz. 4.2 | keep, adapt | adapted to RTS Article 29, the management board adopts the security objectives | RTS Article 29(1), Article 28(2)(c) | in progress |
| 12 information security guidelines | Tz. 4.3 | slim down | merged into six procedures along RTS Articles 30 to 38, content stays | RTS Article 29(2) | in progress |
| Information network and protection needs assessment | Tz. 3.3, 3.4 | replace | transferred into the classification under RTS Article 30, BIA new | RTS Article 30, Article 28(2)(d) | in progress |
| Authorisation concept | Tz. 6.2 to 6.6 | keep, rebuild | continued as access control procedure, need-to-use added, recertification stays | RTS Article 33 | converted |
| Logging requirements | Tz. 5.3, 6.7 | keep | continued unchanged | RTS Article 33, Article 34(f) | implemented |
| End-user computing (IDV) rules and IDV register | Tz. 7.13, 7.14 | slim down | important spreadsheets and macros taken into the classification as ICT assets | RTS Article 30(1) | open |
| Backup concept | Tz. 8.7 | replace | taken into the business continuity plan as a backup section, annual restoration test stays | RTS Article 39(2)(f) and (g), Article 40(1) | open |
| IT emergency concept and IT emergency plans | Chapter 10 | keep and rebuild | emergency concept under MaRisk AT 7.3 stays, the IT part becomes a business continuity plan with cyber-attack scenario and recovery objectives | RTS Articles 39, 40, MaRisk AT 7.3 | open |
| Disruption management | Tz. 8.6 | extend | already extended in 2025 into an incident process with classification and reporting chain | Articles 17 to 19 DORA | implemented |
| Outsourcing register and risk analyses for external procurement | Chapter 9 | keep and extend | extended to all ICT contracts, critical or important functions flagged, contract content and exit strategies added | Article 28(3) DORA, ITS (EU) 2024/2956 | in progress |
Result: no document disappears without replacement, and twelve guidelines become six procedures. New are the four points above, and the institution already implemented incident reporting in 2025. It schedules business continuity first, because the recovery objectives follow from the BIA. The new versions apply from 1 January 2027, until then the BAIT rules remain in force. The remaining questions of factoring and leasing firms before the switch are answered with a model case on the page DORA for factoring and leasing firms.
Typical mistakes in the conversion
| Mistake | Cause | Effect | Remedy |
|---|---|---|---|
| Rules lost when merging the guidelines | Many guidelines become a few procedures. Exception rules, approvals and responsibilities from the old texts get lost in the process | Deviations, for example from patch or password requirements, are granted without approval or deadline, and nobody is responsible for them, although RTS Article 28(2)(b) requires clear tasks and responsibilities | Before merging, record exceptions, approvals and owners for each guideline in the conversion list and reassign them section by section in the new procedure |
| Logging scaled back | The supervisory notice of 21 August 2025 sets out no logging rules of its own for Article 16 like those of RTS Article 12 | RTS Articles 33 and 34(f) nevertheless require logging under the simplified framework, for privileged access and for “events” (German text: “Vorfälle”, incidents) relating to access control, ICT operations and change management | Keep logging and follow the wording of the RTS |
| Backup concept deleted, tests forgotten | “no backup concept any more” is confused with “no backup obligation” | Backup and annual tests of the backup and recovery procedures remain mandatory, the evidence is missing | Take the requirements into the business continuity plan, file test records every year |
How we can help
For institutions of the KWG group, our service for the transition from BAIT to Article 16 rebuilds the existing BAIT documentation with a fixed base scope: inventory, roles, procedures, exercises and evidence. If you first want to know where the gaps are, start with the DORA gap analysis, for the Article 16 framework as well as for the full framework. We know the transition from our work in an ISMS engagement with a factoring firm moving to Article 16 (since 07/2026).
This page provides general information and is not legal advice. Which framework applies to your institution and which obligations arise in detail must be assessed in the individual case.
Frequently asked questions
When will the BAIT be repealed?+
May we take BAIT rules out of force before 2027?+
Is the ICT risk control function the new information security officer?+
Do we have to rewrite all BAIT documents?+
Has the mapping been agreed with BaFin?+
Read more
- DORA Article 16: the simplified ICT risk management framework
- DORA for factoring and leasing: obligations and evidence from 2027
- DORA Article 16 transition: moving from BAIT to the simplified framework
- DORA scope: who does DORA apply to, and which framework?
- DORA incident reporting: classifying and reporting ICT-related incidents
- DORA gap analysis: quick check, Article 16 and full framework
Sources
- BaFin: Circular 10/2017 (BA) BAIT as amended on 16 December 2024 (PDF), in German (retrieved 2026-11-06)
- BaFin: news of 9 January 2025 on changes to IT requirements under DORA, in German (retrieved 2026-11-06)
- BaFin: DORA FAQ, question 13 (KWG group, financial holding companies), in German (retrieved 2026-11-06)
- BaFin: DORA FAQs (overview page), in German (retrieved 2026-11-06)
- BaFin DORA FAQ on whether DORA implementation is a material change under AT 8.2 MaRisk, in German (retrieved 2026-11-06)
- BaFin supervisory notice: guidance on implementing DORA in ICT risk management and ICT third-party risk management, as of June 2024, published 8 July 2024, in German (retrieved 2026-11-06)
- BaFin: supervisory notice of 21 August 2025 on the simplified ICT risk management framework (Article 16 DORA), in German (retrieved 2026-11-06)
- Regulation (EU) 2022/2554 (DORA), German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2024/1774 (RTS on ICT risk management), German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2024/1774, English version (Article 34(f) “events”) (retrieved 2026-11-06)
- Delegated Regulation (EU) 2024/1772 (classification of incidents), German version (retrieved 2026-11-06)
- Delegated Regulation (EU) 2025/301 (content and time limits of incident reports), German version (retrieved 2026-11-06)
- Implementing Regulation (EU) 2024/2956 (register of information), German version (retrieved 2026-11-06)
- German Banking Act (KWG), Section 1a, in German (retrieved 2026-11-06)
- German Banking Act (KWG), Section 65a, in German (retrieved 2026-11-06)
- German BSI Act (BSIG), Section 28, in German (retrieved 2026-11-06)
- BaFin: Circular 06/2026 (BA) MaRisk, as of 30 June 2026 (PDF), in German (retrieved 2026-11-06)
- BaFin: register of information and notification duties, in German (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).